GDPR compliance for cookies is a genuinely stricter requirement than many cookie banners actually implement — the regulation requires real, informed, opt-in consent before setting non-essential cookies, not just displaying a notice while cookies are already being set in the background.
Which cookies actually need consent
Strictly necessary cookies (session handling, CSRF protection, load balancing) generally don't require consent under GDPR, since the site can't function without them — analytics, advertising, and any third-party tracking cookies do require explicit, informed consent before being set, which is the part many implementations get wrong by loading analytics scripts immediately regardless of consent status.
The compliant pattern: block non-essential cookies until consent is given
// don't load analytics/marketing scripts unconditionally in the layout
@if (session('cookie_consent') === 'accepted')
@endifThe key compliance detail is that this script block simply doesn't render at all until consent is recorded — a banner that displays while Google Analytics is already loading in the background elsewhere on the page doesn't meet this requirement, regardless of how the banner itself looks.
Recording consent
Route::post('/cookie-consent', function (Request $request) {
$choice = $request->validate(['choice' => 'required|in:accepted,rejected'])['choice'];
session(['cookie_consent' => $choice]);
// for a longer-lived record than the session, also set a cookie directly
Cookie::queue('cookie_consent', $choice, 60 * 24 * 365); // 1 year
return response()->noContent();
});The consent banner itself
@if (! request()->cookie('cookie_consent'))
@endifGiving users a way to change their choice later
GDPR expects that consent can be withdrawn as easily as it was given — a persistent "cookie preferences" link (in the footer, typically) that reopens the same banner or a fuller preferences panel is expected, not just a one-time prompt on first visit with no way to revisit the choice.
Granular consent by category, for a more complete implementation
A more thorough implementation separates cookies into categories (necessary, analytics, marketing) and lets the user consent to each independently, rather than a single accept-all-or-reject-all choice — this is closer to what stricter interpretations of GDPR (and similar laws like the UK's PECR) actually expect, though a simple accept/reject banner is a reasonable and common starting point for many sites.
Why this is a legal compliance question, not just a technical one
The specific consent requirements and their enforcement vary by jurisdiction and continue to evolve — for a site handling EU visitors' data at any meaningful scale, consulting current guidance or legal counsel on the exact consent flow required is worth doing rather than relying solely on a generic technical implementation pattern like the one above.